CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The InfiniBand stack in the Linux kernel before version 4.5.3 incorrectly relies on the write system call, allowing local users to cause a denial of service or possibly have unspecified other impact via a uAPI interface.
The BPF subsystem in the Linux kernel before version 4.5.5 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly other unspecified impacts via a crafted application on a system with more than 32 Gb of memory or a 1 Tb system.
The replace_map_fd_with_map_ptr function in the Linux kernel before version 4.5.5 does not properly maintain an fd data structure, allowing local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descriptor.
The llc_cmsg_rcv function in the Linux kernel before version 4.5.5 does not initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory by reading a message.
CVE-2016-2157 describes a CSRF vulnerability in mod/assign/adminmanageplugins.php in Moodle that allows remote attackers to hijack the authentication of administrators for managing Assignment plugins.
The exif_process_TIFF_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The exif_process_IFD_TAG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
The grapheme_strpos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The grapheme_stripos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
The xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service through crafted XML data, leading to parser errors.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the global variables _zero_, _one_, or _two_. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which may lead to denial of service or other unspecified impacts.
Integer overflow in the str_pad function in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the php_filter_encode_url function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
Integer overflow in the xml_utf8_encode function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.
The phar_make_dirstream function in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which can lead to denial of service or other unspecified impacts via a crafted TAR archive.
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, there is an issue with handling zero-length uncompressed data, which can lead to denial of service (heap memory corruption) or other unspecified impacts.
The wp_http_validate_url function in WordPress before version 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
The CVE-2016-2221 vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before version 4.4.2 allows remote attackers to redirect users to arbitrary websites. This is exploited through a malformed URL that triggers incorrect hostname parsing.